Analysis
-
max time kernel
94s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 13:13
Behavioral task
behavioral1
Sample
2760-6-0x0000000001F30000-0x0000000002124000-memory.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2760-6-0x0000000001F30000-0x0000000002124000-memory.dll
Resource
win10v2004-20241007-en
General
-
Target
2760-6-0x0000000001F30000-0x0000000002124000-memory.dll
-
Size
2.0MB
-
MD5
50d79e341179c6286fef419863562dd9
-
SHA1
832a1aac88803451f1d0c445a9988f5990de4b16
-
SHA256
7fd0b6927d3fbc4c29aa8c1aa52cfe3844daab99d067b8fdd62cfae1004eae5e
-
SHA512
373433f028c652f32dd648bcb36804c83f9526e447e7b1a94e3c4a6251e96c41ece065e3cc5180d24afe4f7b688fd94f436757dc8c7569cb15daa39fbce323bf
-
SSDEEP
49152:QLyAy9N/YuTV/+Eeqfn8+nFFQCxEsJwKQM:QLyAy9N/YtEeqf8+gqJW
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4516 wrote to memory of 4844 4516 rundll32.exe 83 PID 4516 wrote to memory of 4844 4516 rundll32.exe 83 PID 4516 wrote to memory of 4844 4516 rundll32.exe 83 PID 4844 wrote to memory of 4184 4844 rundll32.exe 84 PID 4844 wrote to memory of 4184 4844 rundll32.exe 84 PID 4844 wrote to memory of 4184 4844 rundll32.exe 84 PID 4184 wrote to memory of 2972 4184 rundll32.exe 85 PID 4184 wrote to memory of 2972 4184 rundll32.exe 85 PID 4184 wrote to memory of 2972 4184 rundll32.exe 85 PID 2972 wrote to memory of 4612 2972 rundll32.exe 86 PID 2972 wrote to memory of 4612 2972 rundll32.exe 86 PID 2972 wrote to memory of 4612 2972 rundll32.exe 86 PID 4612 wrote to memory of 1504 4612 rundll32.exe 87 PID 4612 wrote to memory of 1504 4612 rundll32.exe 87 PID 4612 wrote to memory of 1504 4612 rundll32.exe 87 PID 1504 wrote to memory of 4004 1504 rundll32.exe 88 PID 1504 wrote to memory of 4004 1504 rundll32.exe 88 PID 1504 wrote to memory of 4004 1504 rundll32.exe 88 PID 4004 wrote to memory of 240 4004 rundll32.exe 89 PID 4004 wrote to memory of 240 4004 rundll32.exe 89 PID 4004 wrote to memory of 240 4004 rundll32.exe 89 PID 240 wrote to memory of 3632 240 rundll32.exe 90 PID 240 wrote to memory of 3632 240 rundll32.exe 90 PID 240 wrote to memory of 3632 240 rundll32.exe 90 PID 3632 wrote to memory of 2184 3632 rundll32.exe 91 PID 3632 wrote to memory of 2184 3632 rundll32.exe 91 PID 3632 wrote to memory of 2184 3632 rundll32.exe 91 PID 2184 wrote to memory of 3636 2184 rundll32.exe 92 PID 2184 wrote to memory of 3636 2184 rundll32.exe 92 PID 2184 wrote to memory of 3636 2184 rundll32.exe 92 PID 3636 wrote to memory of 2480 3636 rundll32.exe 93 PID 3636 wrote to memory of 2480 3636 rundll32.exe 93 PID 3636 wrote to memory of 2480 3636 rundll32.exe 93 PID 2480 wrote to memory of 4768 2480 rundll32.exe 94 PID 2480 wrote to memory of 4768 2480 rundll32.exe 94 PID 2480 wrote to memory of 4768 2480 rundll32.exe 94 PID 4768 wrote to memory of 244 4768 rundll32.exe 95 PID 4768 wrote to memory of 244 4768 rundll32.exe 95 PID 4768 wrote to memory of 244 4768 rundll32.exe 95 PID 244 wrote to memory of 4224 244 rundll32.exe 96 PID 244 wrote to memory of 4224 244 rundll32.exe 96 PID 244 wrote to memory of 4224 244 rundll32.exe 96 PID 4224 wrote to memory of 4316 4224 rundll32.exe 97 PID 4224 wrote to memory of 4316 4224 rundll32.exe 97 PID 4224 wrote to memory of 4316 4224 rundll32.exe 97 PID 4316 wrote to memory of 1840 4316 rundll32.exe 98 PID 4316 wrote to memory of 1840 4316 rundll32.exe 98 PID 4316 wrote to memory of 1840 4316 rundll32.exe 98 PID 1840 wrote to memory of 2752 1840 rundll32.exe 99 PID 1840 wrote to memory of 2752 1840 rundll32.exe 99 PID 1840 wrote to memory of 2752 1840 rundll32.exe 99 PID 2752 wrote to memory of 1576 2752 rundll32.exe 100 PID 2752 wrote to memory of 1576 2752 rundll32.exe 100 PID 2752 wrote to memory of 1576 2752 rundll32.exe 100 PID 1576 wrote to memory of 1844 1576 rundll32.exe 101 PID 1576 wrote to memory of 1844 1576 rundll32.exe 101 PID 1576 wrote to memory of 1844 1576 rundll32.exe 101 PID 1844 wrote to memory of 2624 1844 rundll32.exe 102 PID 1844 wrote to memory of 2624 1844 rundll32.exe 102 PID 1844 wrote to memory of 2624 1844 rundll32.exe 102 PID 2624 wrote to memory of 4180 2624 rundll32.exe 103 PID 2624 wrote to memory of 4180 2624 rundll32.exe 103 PID 2624 wrote to memory of 4180 2624 rundll32.exe 103 PID 4180 wrote to memory of 2368 4180 rundll32.exe 104
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#120⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#121⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#123⤵PID:2368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#124⤵PID:4028
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#125⤵PID:2520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#126⤵PID:1140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#127⤵PID:4908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#128⤵PID:3804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#129⤵PID:2096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#130⤵PID:4964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#131⤵PID:3480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#132⤵PID:4124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#133⤵PID:4960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#134⤵PID:4432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#135⤵PID:4108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#136⤵
- System Location Discovery: System Language Discovery
PID:4884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#137⤵
- System Location Discovery: System Language Discovery
PID:3808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#138⤵PID:1568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#139⤵PID:4196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#140⤵PID:3236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#141⤵PID:4848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#142⤵PID:5016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#143⤵PID:2948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#144⤵PID:420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#145⤵PID:3272
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#146⤵PID:4296
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#147⤵PID:4460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#148⤵PID:3568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#149⤵PID:2592
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#150⤵
- System Location Discovery: System Language Discovery
PID:3124 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#151⤵PID:2384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#152⤵PID:4836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#153⤵PID:4736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#154⤵PID:3704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#155⤵PID:1684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#156⤵PID:2896
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#157⤵PID:1432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#158⤵PID:1952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#159⤵PID:4832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#160⤵PID:4872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#161⤵
- System Location Discovery: System Language Discovery
PID:3504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#162⤵PID:4596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#163⤵PID:5100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#164⤵PID:4504
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#165⤵PID:1184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#166⤵PID:3280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#167⤵PID:3368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#168⤵PID:4944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#169⤵PID:2724
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#170⤵PID:1600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#171⤵PID:2100
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#172⤵PID:2220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#173⤵PID:4060
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#174⤵PID:3868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#175⤵PID:5076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#176⤵PID:3260
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#177⤵PID:1740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#178⤵PID:3936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#179⤵PID:3976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#180⤵PID:2224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#181⤵PID:3192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#182⤵PID:4444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#183⤵PID:4484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#184⤵PID:4068
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#185⤵PID:2340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#186⤵PID:1616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#187⤵PID:2648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#188⤵PID:1596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#189⤵PID:1736
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#190⤵PID:3776
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#191⤵PID:956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#192⤵PID:5132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#193⤵
- System Location Discovery: System Language Discovery
PID:5144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#194⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#195⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#196⤵PID:5192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#197⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#198⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#199⤵PID:5240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1100⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1101⤵
- System Location Discovery: System Language Discovery
PID:5272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1102⤵PID:5284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1103⤵PID:5324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1104⤵PID:5336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1105⤵PID:5352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1106⤵PID:5384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1107⤵PID:5416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1108⤵PID:5460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1109⤵PID:5480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1110⤵PID:5520
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1111⤵PID:5572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1112⤵PID:5600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1113⤵PID:5620
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1114⤵PID:5632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1115⤵PID:5648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1116⤵PID:5664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1117⤵PID:5684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1118⤵PID:5712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1119⤵PID:5728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1120⤵PID:5744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1121⤵PID:5764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2760-6-0x0000000001F30000-0x0000000002124000-memory.dll,#1122⤵PID:5784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-